rlgate 0.0.1__py3-none-any.whl

rlgate/probes/grader_strength/revert_probe.py

@@ -0,0 +1,44 @@
+"""§3.4 — the flagship. Remove one hunk of the gold fix; if the grader still scores it pass,
+that hunk is unguarded. Building revert survivors are exploits by construction."""
+
+from __future__ import annotations
+
+from rlgate.core.context import ProbeContext
+from rlgate.core.finding import Evidence, Finding, Severity, VerdictTier
+from rlgate.core.probe import Probe, ProbeKind, ProbeMeta
+from rlgate.core.registry import register
+from rlgate.core.task import Capability, Task
+from rlgate.variants.engine import VariantClass
+
+
+@register
+class RevertProbe(Probe):
+    meta = ProbeMeta(
+        id="grader_strength.revert_probe",
+        family="grader_strength",
+        kind=ProbeKind.GENERIC,
+        severity=Severity.HIGH,
+        requires=frozenset({Capability.GOLD_PATCH}),
+        doc="A gold fix hunk can be removed and the grader still passes (unguarded line).",
+    )
+
+    def run(self, task: Task, ctx: ProbeContext) -> list[Finding]:
+        results = ctx.variants.run_revert()
+        findings: list[Finding] = []
+        for r in results:
+            if r.is_exploit and r.klass is VariantClass.DISCRIMINATED:
+                findings.append(Finding(
+                    probe_id=self.meta.id,
+                    title=f"unguarded fix hunk: {r.variant.origin}",
+                    severity=Severity.HIGH,
+                    verdict=VerdictTier.CONFIRMED,
+                    location=r.variant.origin,
+                    evidence=Evidence(
+                        kind="reproduced_exploit",
+                        detail=f"removing this hunk still scores pass (reward={r.reward}); "
+                               f"variant {r.variant.id}",
+                        replay=f"rlgate replay {task.id} --variant {r.variant.id}",
+                    ),
+                    fix_hint="add a test that fails when this hunk is absent.",
+                ))
+        return findings

rlgate/probes/leakage/git_unreachable_objects.py

@@ -0,0 +1,46 @@
+"""§3.3 — the reference fix survives as an unreachable git object (the MiMo/SQLGlot leak).
+
+We read the object store directly as the auditor, so an agent-side "git commands blocked"
+guard is irrelevant — if the object is on disk, the answer is on disk."""
+
+from __future__ import annotations
+
+from rlgate.core.context import ProbeContext
+from rlgate.core.finding import Evidence, Finding, Severity, VerdictTier
+from rlgate.core.probe import Probe, ProbeKind, ProbeMeta
+from rlgate.core.registry import register
+from rlgate.core.task import Capability, Task
+
+
+@register
+class GitUnreachableObjects(Probe):
+    meta = ProbeMeta(
+        id="leakage.git_unreachable_objects",
+        family="leakage",
+        kind=ProbeKind.GENERIC,
+        severity=Severity.HIGH,
+        requires=frozenset({Capability.GIT_REPO}),
+        doc="Unreachable git objects (deleted-but-unpruned branches) may hold the fix.",
+    )
+
+    def run(self, task: Task, ctx: ProbeContext) -> list[Finding]:
+        with ctx.sandbox.overlay(None) as ovl:
+            res = ovl.exec("git fsck --unreachable --no-reflogs 2>/dev/null | head -n 50")
+        lines = [ln for ln in res.stdout.splitlines() if "unreachable commit" in ln]
+        if not lines:
+            return []
+        sample = lines[0].split()[-1][:12]
+        return [Finding(
+            probe_id=self.meta.id,
+            title=f"{len(lines)} unreachable git commit(s) on disk (e.g. {sample})",
+            severity=Severity.HIGH,
+            verdict=VerdictTier.CONFIRMED,
+            location=".git",
+            evidence=Evidence(
+                kind="reproduced_exploit",
+                detail="later history was deleted but not pruned; readable via the object store",
+                replay="git fsck --unreachable --no-reflogs",
+            ),
+            fix_hint="git reflog expire --expire=now --all && git gc --prune=now; "
+                     "or vendor a clean snapshot at the task base commit.",
+        )]

rlgate/sandbox/_patch.py

@@ -0,0 +1,30 @@
+"""Shared, deterministic patch application (zero fuzz: all-or-nothing). Used by every
+sandbox backend so variant generation behaves identically regardless of where it runs."""
+
+from __future__ import annotations
+
+import subprocess
+from pathlib import Path
+
+
+class PatchConflict(RuntimeError):
+    """A variant patch did not apply cleanly — bucketed as could-not-generate."""
+
+
+def apply_zero_fuzz(root: Path, patch_text: str) -> None:
+    """Apply a unified diff under `root` with no fuzz. Tries `git apply` then `patch`.
+
+    Zero fuzz makes the result deterministic: a hunk applies at its exact location or the
+    whole patch is rejected (raising PatchConflict)."""
+    proc = subprocess.run(
+        ["git", "apply", "--unsafe-paths", "-C0", "-p1", "-"],
+        cwd=root, input=patch_text, text=True, capture_output=True, check=False,
+    )
+    if proc.returncode == 0:
+        return
+    proc = subprocess.run(
+        ["patch", "-p1", "--no-backup-if-mismatch", "-F0", "-s"],
+        cwd=root, input=patch_text, text=True, capture_output=True, check=False,
+    )
+    if proc.returncode != 0:
+        raise PatchConflict(proc.stderr or proc.stdout)

rlgate/sandbox/base.py

@@ -0,0 +1,63 @@
+"""Execution substrate. Backends (local/docker/daytona) implement this ABC.
+
+The key operations the probes need: build once, snapshot, cheap per-variant overlays, exec,
+inspect permissions, and kill stray candidate processes (forgery/race probes)."""
+
+from __future__ import annotations
+
+from abc import ABC, abstractmethod
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Self
+
+
+@dataclass
+class ExecResult:
+    exit_code: int
+    stdout: str
+    stderr: str
+
+
+@dataclass
+class Perms:
+    mode: int             # e.g. 0o755
+    exists: bool = True
+
+    @property
+    def world_readable(self) -> bool:
+        return self.exists and bool(self.mode & 0o004)
+
+
+class Overlay(ABC):
+    """A cheap, disposable copy of the workspace with a patch applied."""
+
+    root: Path
+
+    @abstractmethod
+    def exec(self, cmd: str, timeout: int = 900) -> ExecResult: ...
+
+    @abstractmethod
+    def read_perms(self, path: str) -> Perms: ...
+
+    @abstractmethod
+    def close(self) -> None: ...
+
+    def __enter__(self) -> Self:
+        return self
+
+    def __exit__(self, *exc) -> None:
+        self.close()
+
+
+class Sandbox(ABC):
+    @abstractmethod
+    def build(self) -> None:
+        """Build the task image / prepare the pristine workspace once."""
+
+    @abstractmethod
+    def overlay(self, patch_text: str | None = None) -> Overlay:
+        """A fresh overlay on the snapshot, optionally with a patch applied (zero fuzz)."""
+
+    @abstractmethod
+    def pkill_user(self, user: str) -> None:
+        """Kill detached candidate processes before scoring (race-probe defense)."""

rlgate/sandbox/docker.py

@@ -0,0 +1,120 @@
+"""Docker sandbox: real isolation for running untrusted variants, container graders, and the
+live forgery/race probes. Same ABC as the local backend.
+
+Model: build the image once; keep a pristine host copy of the workspace as the snapshot.
+Each overlay is a fresh container plus a host copy with the variant patch applied (zero fuzz,
+shared logic) and copied in — so variant generation is identical to the local backend and the
+image needs no git/patch tooling.
+"""
+
+from __future__ import annotations
+
+import shutil
+import subprocess
+import tempfile
+import uuid
+from pathlib import Path
+
+from rlgate.sandbox._patch import apply_zero_fuzz
+from rlgate.sandbox.base import ExecResult, Overlay, Perms, Sandbox
+
+
+class DockerUnavailable(RuntimeError):
+    pass
+
+
+def available() -> bool:
+    try:
+        return subprocess.run(["docker", "info"], capture_output=True, check=False).returncode == 0
+    except FileNotFoundError:
+        return False
+
+
+def _docker(*args: str, **kw) -> subprocess.CompletedProcess:
+    return subprocess.run(["docker", *args], capture_output=True, text=True, check=False, **kw)
+
+
+class DockerOverlay(Overlay):
+    def __init__(self, container_id: str, host_copy: Path, sandbox: DockerSandbox) -> None:
+        self.container_id = container_id
+        self.root = host_copy          # host-side view (for parity); container path is /work
+        self._sandbox = sandbox
+
+    def exec(self, cmd: str, timeout: int = 900) -> ExecResult:
+        p = _docker("exec", "-w", "/work", self.container_id, "sh", "-c", cmd, timeout=timeout)
+        return ExecResult(p.returncode, p.stdout, p.stderr)
+
+    def read_perms(self, path: str) -> Perms:
+        p = _docker("exec", self.container_id, "stat", "-c", "%a", f"/work/{path.lstrip('/')}")
+        if p.returncode != 0:
+            return Perms(mode=0, exists=False)
+        return Perms(mode=int(p.stdout.strip(), 8))
+
+    def close(self) -> None:
+        _docker("rm", "-f", self.container_id)
+        self._sandbox._live.discard(self.container_id)
+        shutil.rmtree(self.root, ignore_errors=True)
+
+
+class DockerSandbox(Sandbox):
+    def __init__(self, workspace: Path, image_ref: str | None = None,
+                 dockerfile: Path | None = None, task_id: str = "task") -> None:
+        self.workspace = Path(workspace)
+        self.image_ref = image_ref
+        self.dockerfile = Path(dockerfile) if dockerfile else None
+        self.task_id = task_id
+        self._tag: str | None = None
+        self._snapshot: Path | None = None
+        self._live: set[str] = set()
+
+    @classmethod
+    def from_task(cls, task) -> DockerSandbox:
+        """grader.image is either a Dockerfile path (build it) or an existing image ref."""
+        img = task.grader.image
+        p = Path(img) if img else None
+        if p and p.exists() and p.is_file():
+            return cls(task.repo_dir, dockerfile=p, task_id=task.id)
+        return cls(task.repo_dir, image_ref=img, task_id=task.id)
+
+    def build(self) -> None:
+        if not available():
+            raise DockerUnavailable("docker is not available on this host")
+        if self.dockerfile:
+            self._tag = f"rlgate-{self.task_id}-{uuid.uuid4().hex[:8]}"
+            r = _docker("build", "-t", self._tag, "-f", str(self.dockerfile),
+                        str(self.dockerfile.parent))
+            if r.returncode != 0:
+                raise DockerUnavailable(f"image build failed:\n{r.stderr}")
+        else:
+            self._tag = self.image_ref
+        # pristine host copy of the workspace (the snapshot we cp into each container)
+        snap = Path(tempfile.mkdtemp(prefix="rlgate-dsnap-"))
+        shutil.rmtree(snap)
+        shutil.copytree(self.workspace, snap, symlinks=True)
+        self._snapshot = snap
+
+    def overlay(self, patch_text: str | None = None) -> DockerOverlay:
+        assert self._snapshot is not None and self._tag is not None, "call build() first"
+        host_copy = Path(tempfile.mkdtemp(prefix="rlgate-dovl-"))
+        shutil.rmtree(host_copy)
+        shutil.copytree(self._snapshot, host_copy, symlinks=True)
+        if patch_text:
+            apply_zero_fuzz(host_copy, patch_text)
+
+        run = _docker("run", "-d", "--network=none", "-w", "/work",
+                      self._tag, "sleep", "infinity")
+        if run.returncode != 0:
+            raise DockerUnavailable(f"container start failed:\n{run.stderr}")
+        cid = run.stdout.strip()
+        self._live.add(cid)
+        _docker("exec", cid, "mkdir", "-p", "/work")
+        cp = _docker("cp", f"{host_copy}/.", f"{cid}:/work")
+        if cp.returncode != 0:
+            _docker("rm", "-f", cid)
+            raise DockerUnavailable(f"workspace copy failed:\n{cp.stderr}")
+        return DockerOverlay(cid, host_copy, self)
+
+    def pkill_user(self, user: str) -> None:
+        """Kill detached candidate processes in every live container before scoring."""
+        for cid in list(self._live):
+            _docker("exec", cid, "pkill", "-u", user)

rlgate/sandbox/local.py

@@ -0,0 +1,62 @@
+"""Local sandbox: copy the workspace to a temp dir, apply a patch with zero fuzz, run the
+grader via subprocess. No isolation guarantees — for dev and CI fixtures only. The Docker
+backend implements the same ABC for real isolation (and the race/perms probes)."""
+
+from __future__ import annotations
+
+import os
+import shutil
+import subprocess
+import tempfile
+from pathlib import Path
+
+from rlgate.sandbox._patch import PatchConflict, apply_zero_fuzz
+from rlgate.sandbox.base import ExecResult, Overlay, Perms, Sandbox
+
+__all__ = ["LocalOverlay", "LocalSandbox", "PatchConflict"]
+
+
+class LocalOverlay(Overlay):
+    def __init__(self, root: Path) -> None:
+        self.root = root
+
+    def exec(self, cmd: str, timeout: int = 900) -> ExecResult:
+        p = subprocess.run(
+            cmd, shell=True, cwd=self.root, capture_output=True, text=True,
+            timeout=timeout, check=False,
+            env={**os.environ, "RLGATE_SANDBOX": "local"},
+        )
+        return ExecResult(p.returncode, p.stdout, p.stderr)
+
+    def read_perms(self, path: str) -> Perms:
+        target = self.root / path.lstrip("/")
+        if not target.exists():
+            return Perms(mode=0, exists=False)
+        return Perms(mode=os.stat(target).st_mode & 0o777)
+
+    def close(self) -> None:
+        shutil.rmtree(self.root, ignore_errors=True)
+
+
+class LocalSandbox(Sandbox):
+    def __init__(self, workspace: Path) -> None:
+        self.workspace = Path(workspace)
+        self._snapshot: Path | None = None
+
+    def build(self) -> None:
+        snap = Path(tempfile.mkdtemp(prefix="rlgate-snap-"))
+        shutil.rmtree(snap)
+        shutil.copytree(self.workspace, snap, symlinks=True)
+        self._snapshot = snap
+
+    def overlay(self, patch_text: str | None = None) -> LocalOverlay:
+        assert self._snapshot is not None, "call build() first"
+        root = Path(tempfile.mkdtemp(prefix="rlgate-ovl-"))
+        shutil.rmtree(root)
+        shutil.copytree(self._snapshot, root, symlinks=True)
+        if patch_text:
+            apply_zero_fuzz(root, patch_text)
+        return LocalOverlay(root)
+
+    def pkill_user(self, user: str) -> None:
+        subprocess.run(["pkill", "-u", user], capture_output=True, check=False)

rlgate/sandbox/select.py

@@ -0,0 +1,22 @@
+"""Backend selection. `auto` uses Docker when the task declares a container image and Docker
+is available, otherwise the local sandbox. Explicit `local`/`docker` override the choice."""
+
+from __future__ import annotations
+
+from rlgate.core.task import Capability, Task
+from rlgate.sandbox.base import Sandbox
+
+
+def build_sandbox(task: Task, prefer: str = "auto") -> Sandbox:
+    from rlgate.sandbox.docker import DockerSandbox, available
+    from rlgate.sandbox.local import LocalSandbox
+
+    if prefer == "local":
+        return LocalSandbox(task.repo_dir)
+    if prefer == "docker":
+        return DockerSandbox.from_task(task)
+
+    # auto
+    if Capability.CONTAINER in task.capabilities and available():
+        return DockerSandbox.from_task(task)
+    return LocalSandbox(task.repo_dir)

rlgate/variants/engine.py

@@ -0,0 +1,76 @@
+"""Generate variants, build-gate them, run on the per-test subset, classify, and score.
+
+Classification (ARCHITECTURE / PLAN §3.4):
+  - did_not_build : patch didn't apply, or the build/compile failed  → NOT coverage signal
+  - failed_all    : every subset test failed (refactor/rename hunk)   → NOT coverage signal
+  - discriminated : built and some tests passed, some failed          → the real signal
+A *building* revert/stub survivor that still scores pass is a reproduced exploit.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from enum import Enum
+
+from rlgate.core.context import Baseline
+from rlgate.core.task import Task
+from rlgate.sandbox.base import Sandbox
+from rlgate.sandbox.local import PatchConflict
+from rlgate.variants.revert import Variant, revert_variants
+
+
+class VariantClass(Enum):
+    DID_NOT_BUILD = "did_not_build"
+    FAILED_ALL = "failed_all"
+    DISCRIMINATED = "discriminated"
+
+
+@dataclass
+class VariantResult:
+    variant: Variant
+    klass: VariantClass
+    reward: float                 # grader reward on this variant (only meaningful if built)
+    is_exploit: bool              # built + scored pass despite being wrong-by-construction
+
+
+class VariantEngine:
+    def __init__(self, task: Task, sandbox: Sandbox, baseline: Baseline) -> None:
+        self.task = task
+        self.sandbox = sandbox
+        self.baseline = baseline
+
+    def run_revert(self) -> list[VariantResult]:
+        assert self.task.gold_patch is not None
+        results: list[VariantResult] = []
+        for v in revert_variants(self.task.gold_patch):
+            results.append(self._score(v))
+        return results
+
+    def _score(self, v: Variant) -> VariantResult:
+        try:
+            overlay = self.sandbox.overlay(v.patch_text)
+        except PatchConflict:
+            return VariantResult(v, VariantClass.DID_NOT_BUILD, 0.0, False)
+        with overlay:
+            run = overlay.exec(self.task.grader.run)
+            if run.exit_code == 127 or "No such file" in run.stderr:
+                return VariantResult(v, VariantClass.DID_NOT_BUILD, 0.0, False)
+            reward = self._reward_from(run.exit_code)
+            # pass despite a missing fix hunk → exploit; full fail → good coverage.
+            if reward >= self.task.grader.pass_reward:
+                return VariantResult(v, VariantClass.DISCRIMINATED, reward, True)
+            if reward <= 0.0:
+                return VariantResult(v, VariantClass.FAILED_ALL, reward, False)
+            return VariantResult(v, VariantClass.DISCRIMINATED, reward, False)
+
+    def _reward_from(self, exit_code: int) -> float:
+        return self.task.grader.pass_reward if exit_code == 0 else 0.0
+
+    @staticmethod
+    def discrimination_score(results: list[VariantResult]) -> float:
+        """Fraction of *building* variants the grader correctly rejected (higher = stronger)."""
+        built = [r for r in results if r.klass is not VariantClass.DID_NOT_BUILD]
+        if not built:
+            return 1.0
+        caught = sum(1 for r in built if not r.is_exploit)
+        return caught / len(built)

rlgate/variants/revert.py

@@ -0,0 +1,70 @@
+"""Deterministic variant GENERATION (see ARCHITECTURE §2a).
+
+The gold patch has an explicit, ordered hunk structure. A revert variant = the gold patch
+with exactly one hunk removed — a minimal, known-wrong solution (non-equivalent by
+construction). Generation is a pure function of the patch bytes: no RNG, no search.
+"""
+
+from __future__ import annotations
+
+import hashlib
+from dataclasses import dataclass
+
+from rlgate.core.task import Patch
+
+OPERATORS_VERSION = "operators@v1"
+
+
+@dataclass(frozen=True)
+class Variant:
+    id: str                 # content-addressed; identical inputs → identical id
+    operator: str           # "revert" | "stub" | …
+    patch_text: str         # the (gold-minus-hunk) patch to apply on the base tree
+    origin: str             # human-readable location, e.g. "path/to/file.py#hunk2"
+
+
+def _variant_id(gold_sha: str, origin: str, operator: str) -> str:
+    key = f"{gold_sha}|{origin}|{operator}|{OPERATORS_VERSION}"
+    return hashlib.sha256(key.encode()).hexdigest()[:16]
+
+
+def revert_variants(gold: Patch) -> list[Variant]:
+    """One variant per hunk: the gold patch with that single hunk omitted.
+
+    Hunks are addressed by (file, hunk_index) from the parsed diff — stable and ordered.
+    """
+    ps = gold.patchset
+    variants: list[Variant] = []
+    for pf in ps:
+        for i, _hunk in enumerate(pf):
+            origin = f"{pf.path}#hunk{i}"
+            text = _patch_without(ps, pf.path, i)
+            if text is None:
+                continue  # omitting this hunk left the file empty of changes; skip
+            variants.append(Variant(
+                id=_variant_id(gold.sha256, origin, "revert"),
+                operator="revert",
+                patch_text=text,
+                origin=origin,
+            ))
+    return variants
+
+
+def _patch_without(ps, file_path: str, drop_index: int) -> str | None:
+    """Rebuild the unified diff omitting one hunk of one file. Pure string transform."""
+    out_files = []
+    for pf in ps:
+        kept = [h for j, h in enumerate(pf) if not (pf.path == file_path and j == drop_index)]
+        if not kept:
+            continue
+        header = _file_header(pf)
+        out_files.append(header + "".join(str(h) for h in kept))
+    text = "".join(out_files)
+    return text or None
+
+
+def _file_header(pf) -> str:
+    # unidiff exposes the per-file header lines; reconstruct the minimal valid header.
+    src = pf.source_file or ("a/" + pf.path)
+    tgt = pf.target_file or ("b/" + pf.path)
+    return f"--- {src}\n+++ {tgt}\n"

rlgate-0.0.1.dist-info/METADATA

@@ -0,0 +1,81 @@
+Metadata-Version: 2.5
+Name: rlgate
+Version: 0.0.1
+Summary: A deterministic, third-party auditor that finds reward-hacking vulnerabilities in RL/eval environments.
+Project-URL: Homepage, https://github.com/deepak-foundryai/rlgate
+Project-URL: Repository, https://github.com/deepak-foundryai/rlgate
+Project-URL: Issues, https://github.com/deepak-foundryai/rlgate/issues
+Author: rlgate contributors
+License: MIT
+License-File: LICENSE
+Keywords: auditing,evals,grader,llm,reward,reward-hacking,rl
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Scientific/Engineering :: Artificial Intelligence
+Classifier: Topic :: Software Development :: Testing
+Requires-Python: >=3.12
+Requires-Dist: pyyaml>=6.0
+Requires-Dist: unidiff>=0.7.5
+Provides-Extra: dev
+Requires-Dist: pyright>=1.1; extra == 'dev'
+Requires-Dist: pytest>=8.0; extra == 'dev'
+Requires-Dist: ruff>=0.6; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# rlgate
+
+**A deterministic, third-party auditor that finds reward-hacking vulnerabilities in RL/eval
+environments** — before you train on them.
+
+rlgate is not an environment framework and not a trajectory benchmark. It *consumes* any
+environment (via a one-file declarative descriptor) and attacks its grader with deterministic
+probes: it reverts hunks of the gold fix to find unguarded tests, plants forged artifacts to
+find grading-channel forgery, walks the git object store to find leaked answers, and lints the
+reward formula for design debt. Every finding is a **reproduced exploit or a line of code** —
+never a threshold on a score.
+
+See **[PLAN.md](PLAN.md)** for the methodology and **[ARCHITECTURE.md](ARCHITECTURE.md)** for
+the design.
+
+## Quickstart
+
+Run it as an isolated tool straight from the repo (no clone, no install):
+
+```bash
+uvx --from git+https://github.com/deepak-foundryai/rlgate rlgate list-probes
+uvx --from git+https://github.com/deepak-foundryai/rlgate rlgate audit path/to/env --gate
+```
+
+Or for development:
+
+```bash
+uv pip install -e ".[dev]"      # or: pip install -e ".[dev]"
+rlgate list-probes
+rlgate audit path/to/env --gate # exits non-zero on FIX/DROP (CI mode)
+```
+
+Once published to PyPI: `uvx rlgate audit ./env` or `uv tool install rlgate`.
+
+Describe any environment once — no code:
+
+```yaml
+# task.rlgate.yaml
+workspace: ./repo
+gold_patch: ./solution/fix.patch        # optional → enables the revert probe
+grader:
+  run: "bash run_tests.sh"
+  report: {format: junit, path: /out/results.xml}
+```
+
+Capabilities are derived from which keys you fill in; probes that need a missing capability
+skip silently. Nothing in a probe mentions a benchmark.
+
+## Status
+
+Milestone 0: core contracts + local sandbox + baseline invariant + generic ingestion + three
+probes (leakage, revert, forgery) + fixtures + CI. Contributions welcome — see
+[CONTRIBUTING.md](CONTRIBUTING.md).
+
+MIT licensed.